Search the archive

TWO ALLEGED ‘TEAMPCP' HACKERS ARRESTED IN AUSTRALIA

Australian police arrested two Western Australian men, aged 21 and 23, over alleged TeamPCP activity.

CISA ORDERS FEDERAL AGENCIES TO PATCH THE ACTIVELY EXPLOITED ORACLE FLAW BY AUGUST 27

CISA added CVE-2026-21962 (CVSS 10.0) to the KEV catalog following active exploitation of the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. Federal agencies must apply the January 2026 patch by August 27.

EMPLOYEE BENEFITS PLATFORM PAYLOGIX SAYS HACKERS STOLE FINANCIAL AND HEALTH DATA

Employee benefits provider Paylogix disclosed that they experienced a data breach last November that exposed data belonging to at least 65,000 individuals. The compromised data includes SSNs, electronic signatures, financial account information, medical data, passport numbers, and taxpayer IDs. The Akira ransomware group added Paylogix to its leak site back in January.

UBIQUITI PATCHES THREE MAX SEVERITY SECURITY VULNERABILITIES

Ubiquiti patched three critical (CVSS 10) vulnerabilities across their UniFi Protect Application, UniFi Talk Application, and UniFi OS Server products. Two of the vulnerabilities allow attackers to exploit improper input validation in the UniFi Protect Application video surveillance platform and UniFi Talk Application to achieve command injection. The third allows attackers to bypass authentication on UniFi OS devices by exploiting a CRLF injection flaw.

THE PATCH WINDOW IS COLLAPSING: WHY SECURITY NEEDS A NEW CONTROL PLANE

AI-accelerated exploit development has compressed the vulnerability exploitation window to mere hours, fundamentally outpacing traditional enterprise patch validation cycles. To bridge this critical exposure gap, shift toward network-enforced control planes that actively contain threats while permanent patches are tested. By deploying immediate compensating measures like dynamic segmentation and adaptive rate limiting, security teams can secure vulnerable assets without disrupting operations. Network-level stream throttling successfully mitigates the active threat without forcing organizations to completely disable the vulnerable protocol.

DRIVE-BY AGENT HIJACKING: ONE WEBSITE VISIT, PERSISTENT MODEL POISONING

Cyera disclosed CVE-2026-65105 in NVIDIA NemoClaw. NemoClaw's setup binds Ollama to 0.0.0.0:11434, disabling Ollama's Host-header validation, allowing for an attacker-controlled site to use DNS rebinding to reach the victim's local Ollama API without authentication. The attacker can list models, extract templates and prompts, delete or overwrite models, consume GPU resources, and sign users out. By modifying a model's chat template, the attacker can append hidden instructions to every future system prompt.

PWNING CALL OF DUTY 1: A 20-YEAR-OLD RCE, FOUND IN AN EVENING WITH AI

Researchers tested Call of Duty 1's Linux dedicated server in Docker, where they found a stack overflow in the rcon map command. A 72-byte buffer accepted an unchecked map name. Sending 76 bytes overwrote the saved return address, and input filtering blocked high-byte addresses and int 0x80. The exploit used a low-memory jmp esp gadget and alphanumeric-safe shellcode with sysentera and it achieved a shell in the game-server process. The flaw requires the rcon password, making it post-authentication RCE.

demand.

INTRODUCING RUN SDK: SECURE EVAL FOR YOUR AGENTS

Vercel introduced the Run SDK to securely execute untrusted JavaScript and type-stripped TypeScript for agent workflows within the Vercel AI SDK. The package utilizes a hardened QuickJS sandbox to isolate code execution from application secrets, the Node.js environment, and the network. Developers can expose narrowly scoped host functions to the sandbox, enforce resource limits, and pause execution for authentication or human approval.

ALICE (PRODUCT LAUNCH)

Alice tests models before release, simulates malicious prompts, and monitors deployed systems. Teams set business rules, run breach simulations, and track traffic.

THREAT MODEL GENERATOR

A set of agent skills for producing threat models for open-source projects, including an orchestrator and independently invocable specialists.

BEHAVIORALLY FINGERPRINTING OX ALPHA'S PROVENANCE AND CENSORSHIP

CTGT researchers have used behavioral fingerprinting to link the anonymous "Ox Alpha" model on OpenRouter to Zhipu's GLM-5.x family. Despite system prompts instructing the model to conceal its identity, researchers identified matching Z.AI error codes, a 1.0 temperature ceiling, and an exact tokenizer match. The analysis also revealed a highly targeted censorship blacklist designed to evade standard foreign-interest audits. While Ox Alpha answers queries about Xinjiang and Taiwan identically to American models, it strictly blocks seven domestic legitimacy topics including the 2018 term limits removal and Xi Jinping. The model operators have not officially disclosed this information, so the attribution relies entirely on CTGT's LineageEval testing instrument.

A CAUTIONARY TALE ABOUT DATA BREACH CLAIMS, VERIFICATION AND CARHARTT

Troy Hunt investigated ShinyHunters' claim of a 24.8 million-record data breach at Carhartt and discovered the dataset was heavily contaminated with synthetic information. Through AI-assisted and manual verification, Hunt identified TPC-DS benchmark data, Microsoft 365 routing duplicates, and highly uniform birth distributions. This forensic analysis reduced the actual number of compromised records to roughly 12.9 million. Hunt concluded that while Carhartt suffered a genuine breach, the threat actors likely exfiltrated a Databricks instance where production customer records were stored alongside unlabeled test data rather than fabricating the dump outright.

INTERPOL OPERATION JACKAL IV ARRESTS 58, IDENTIFIES 263 IN GLOBAL CYBER FRAUD CRACKDOWN

INTERPOL's eight-month Operation Jackal IV involved 22 countries and targeted West African crime groups. Police arrested 58 people and identified 263 suspects. Investigators linked 196 people to a crime-as-a-service network supplying domains and laundering support with an estimated €143 million stolen through fake investment offers.

AUSTRALIA WARNS OF ACTIVE EXPLOITATION OF CRITICAL TEAMCITY SERVER FLAW

The Australian Cyber Security Centre reports active exploitation of CVE-2026-63077, a critical authentication bypass in JetBrains TeamCity On-Premises, targeting local organizations.

APPLE RESCUES HIDE MY EMAIL FEATURE FROM THE PRIVACY SCRAP HEAP

Apple will keep Hide My Email aliases on @icloud.com after planning a move to @private.icloud.com.

SENSITIVE INFORMATION EXPOSED IN NUTEX HEALTH DATA BREACH

Nutex Health disclosed unauthorized network access and file exfiltration in an SEC filing.

CRITICAL KEYCLOAK PASSWORD RESET FLAW COULD LET UNAUTHENTICATED ATTACKERS TAKE OVER ANY ACCOUNT

CVE-2026-18963 (CVSS 9.1) lets an unauthenticated attacker send a crafted request to Keycloak's reset-credentials endpoint, bypassing the email verification via recovery token and allowing the attacker to update the account password, enabling full account takeover. Administrators should update Keycloak and disable "Forgot password" in every realm until servers are patched.

RELIAQUEST CONFIRMS SHINYHUNTERS HACK

ShinyHunters ran a phishing campaign using "company.claims" domains, then called ReliaQuest staff posing as security employees to push them to a fake SSO page. One employee entered a password and approved a push notification, giving attackers a brief session on the identity dashboard. ReliaQuest says access was view-only, all further access attempts were blocked, no other identities or business apps were reached, no customer data was taken, and no ransomware was involved.

HACKERS PLACE FAKE CODEX DOWNLOAD ABOVE LEGITIMATE OPENAI RESULT TO INFECT MAC USERS

Threat actors are leveraging sponsored Google Search ads to position fake OpenAI Codex download pages above legitimate results. The campaign utilizes a ClickFix-style social engineering trick to convince macOS users to paste a malicious Terminal command that decodes a Base64 URL, strips quarantine attributes using xattr -c, and drops a universal Mach-O payload linked to Atomic macOS Stealer (AMOS) infrastructure. Security teams should proactively block associated domains like brightlinks[.]com and configure SIEM alerts for any curl-to-zsh pipelines paired with xattr -c execution.

TEXT TEMPLATE

T4 template files (.tt) run C# or VB code at build time through TextTransform.exe, TextTransformCore.exe, t4.exe, and MSBuild.exe. Attackers can plant malicious .tt files on developer machines or in build pipelines to trigger code execution, including supply chain scenarios. This post provides working PoC templates that spawn calc.exe or a MessageBox, and shows how tampering a .csproj with TextTemplatingFileGenerator entries lets MSBuild.exe compile and run arbitrary .tt code via the /t:Transform flag. Detection relies on Sysmon: process creation for the four binaries, image loads of three Microsoft.TextTemplating DLLs (only with MSBuild), and file creation in %Temp% during MSBuild transforms, since t4.exe also spawns dotnet.exe and csc.dll to compile the payload.

BAD CONNECTION: UNCOVERING GLOBAL TELECOM EXPLOITATION BY COVERT SURVEILLANCE ACTORS

Citizen Lab found two surveillance vendors exploiting SS7 and Diameter signalling to track phones globally. One campaign hit a VVIP executive's phone across 11 operator identities in nine countries in four hours, switching protocols to dodge firewalls. A second used a malicious SMS with hidden SIM commands to turn a phone into a tracking beacon.

AUDITING MICROSOFT DEFENDER AND INTUNE CONFIGURATION CHANGES

Microsoft's unified Defender SecOps portal contains a critical logging gap: changes to security-critical settings, such as Tamper Protection and Intune device policies, do not generate default alerts. To maintain a reliable audit trail of configuration changes, security teams must manually engineer custom detections. This requires enabling Unified Audit Log integration, forwarding Purview audit data into the CloudAppEvents table via Defender for Cloud Apps, and actively routing Intune operational logs to Log Analytics for KQL-based hunting.

DISROBE

Decompile, deobfuscate, and unpack almost anything. Disrobe is a universal, deterministic, single-binary reverse-engineering toolkit in Rust for Python, JVM/Android, .NET, WebAssembly, JS, Go, and native packers (UPX/PyArmor/PyInstaller/Nuitka) and 20+ more. It was built for malware analysis, CTFs, and security research.

STAYING AHEAD OF ADVERSARIAL AI THROUGH AGENTIC SOURCE CODE REVIEW

Mandiant's Agentic Vulnerability Discovery Harness (AVDH) is a Gemini-powered multi-agent pipeline built on Google's Agent Development Kit. The tool conducts deep source code reviews by autonomously chaining threat modeling, entry-point discovery, and hypothesis generation before escalating confirmed findings for human validation. Mandiant positions the harness as a point-in-time, deep-dive complement to continuous scanning tools like CodeMender, establishing a robust two-layered defensive strategy.

BLACKLIGHT

Blacklight is a cross-platform toolkit for mapping, analyzing, and understanding the local AI agent attack surface.

THREAT HUNTING USING PAIR PROBABILITIES

A KQL threat hunting technique built on Microsoft's pair_probabilities_fl() user-defined function calculates how statistically unusual a categorical pair (like a binary and its execution directory) is across a dataset, surfacing outliers such as cmd.exe launching from a user's Desktop instead of System32. The author extended the function to return top co-occurring values, per-device context, and occurrence counts alongside the core probability metrics (P_A|B, Lift, and Jaccard), making rare pairings easier to triage. The approach is explicitly framed as a statistical rarity detector rather than a maliciousness classifier, useful for narrowing investigation scope but unreliable on small datasets or environments where malicious activity has already been baked into the baseline.

THOUGHTS ON RESPONSIBLE DISCLOSURE

Security researchers at Mysk publicly disclosed three WebKit vulnerabilities that leak users' DNS traffic and real IP addresses, successfully bypassing privacy protections in iCloud Private Relay and proxy-based browsers like Tor. Frustrated by Apple's historically slow patch cycles, the team bypassed standard coordinated disclosure, opting to publicly release the details after privately securing mitigations for Psylo and the Onion Browser. While Apple patched iCloud Private Relay within two weeks of the announcement, the underlying WebKit proxy flaws remain active, forcing affected users to rely on full-device VPNs for comprehensive protection.

INSIDE AN AI-RUN BUG BOUNTY REPORT

Anshuman Bhartiya details his setup and experience with a largely AI-driven bug bounty workflow. Bhartiya uses a custom-built harness that uses the pi coding-agent harness to monitor source code changes and route security-relevant diffs through 18 deterministic, vulnerability-specific detectors. The report was then generated and submitted by Claude, with the researcher only reviewing and guiding the agent.

WHATSAPP TIGHTENS ACCOUNT SECURITY WITH STRONGER TWO-STEP VERIFICATION AND MORE

WhatsApp now supports longer two-step verification passwords with letters, numbers, and special characters.

MARIMO NOTEBOOK FLAW COULD RUN MCP COMMANDS BEFORE CELLS EXECUTE IN EDIT MODE

Marimo patched CVE-2026-75149 (CVSS 8.8), a code injection flaw in versions before 0.23.15 that let a crafted notebook launch an attacker-controlled MCP server command as a local subprocess the moment the notebook opened in edit mode, before any cell executed, so users should upgrade to 0.24.0.

ALATION CONFIRMS CYBERATTACK AFTER REPORTING SYSTEM INCIDENT

Enterprise data software provider Alation confirmed unauthorized activity in one system after users experienced degraded availability earlier this week. The service disruption was resolved within an hour. The company has not identified the attack method, root cause, affected customer count, data exposure, notification status, or recommended defensive actions.

AUSTRALIAN HOTEL CHAIN LEAKS GUESTS' PII AFTER BREACH AT THIRD-PARTY DATABASE OPERATOR

Quest identified unauthorized database access on August 17 through a third-party provider. Records from before June 2025 exposed guest names and contact details. Some included dates of birth. The company says it notified affected guests, contained the incident, remediated systems, and began forensic work.

HACKERS TARGET WORDPRESS SITES IN MINIORANGE AUTH BYPASS ATTACKS

Attackers are actively chaining two critical vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the miniOrange SAML 2.0 SSO plugin to bypass authentication and gain administrator access to WordPress sites. Malicious actors can successfully forge legitimate SAML responses by manipulating cryptographic algorithms and bypassing OpenSSL signature checks. Administrators must manually verify their plugin version and immediately upgrade to the latest patched release, as the native WordPress dashboard will not surface update warnings for premium editions.

GHSA-864F-RCV7-6RH4: CRITICAL TYPE CONFUSION VULNERABILITY IN ISOLATED-VM

Endor Labs found a type confusion bug in isolated-vm's ExternalCopy transferList handling. A getter returns different values across two validation walks, letting attacker code pass a bad pointer through an unchecked cast. From one shared ivm.Reference, researchers reached the ExternalCopy constructor, crashed the host with SIGSEGV, then built a working exploit that recovers ASLR base, forges a vtable, and redirects an indirect call to invoke a chosen libc function. The vulnerability affects isolated-vm versions below 7.0.1 and 6.2.0, used by n8n, Activepieces, Mastra, Budibase, Directus, and Rocket.Chat. Upgrade immediately and audit which capabilities you pass into any sandboxed Reference.

DETECTING (EVIL) DYLIBS

This post details how attackers utilize macOS dynamic library (dylib) injection to inherit a host process's trust, entitlements, and TCC grants while blinding native security tools. By employing techniques such as DYLD_INSERT_LIBRARIES injection, @rpath hijacking, or trojanizing libraries, threat actors can bypass System Integrity Protection (SIP) and achieve deep persistence. To close this process-level blind spot, the post recommends that security tools statically parse Mach-O LC_LOAD_DYLIB commands for collisions, dynamically enumerate loaded libraries, and subscribe to Endpoint Security's ES_EVENT_TYPE_AUTH_MMAP to intercept malicious dylibs before they map into memory.

PUTTING MODELS TO THE SECURE CODING TEST: PLAN VS DEFAULT MODE

A researcher performed a test where they instructed Sonnet 5, Composer 2.5, and GPT 5.5 to construct a webapp using the same prompt in both normal and plan modes to observe if plan mode had any noticeable impact on secure coding practices. All six implementations produced an identical IDOR vulnerability in addition to other vulnerabilities that varied across implementations. While Sonnet 5 produced a much more mature implementation in plan mode and Composer 2.5 produced the most glaring security vulnerability while using plan mode, the experiment proved inconclusive on whether plan mode produced more secure code.

INTRODUCING TRUFFLEHOG AWS ANALYZE: KNOW WHAT A LEAKED AWS KEY CAN REACH

TruffleHog AWS Analyze added an AWS-specific view to TruffleHog Enterprise that resolves the IAM principal behind a leaked access key and maps its policies, group memberships, and assumable-role paths up to two trust-policy hops away.

OPENRISK

OpenRisk is a modern, enterprise-grade Risk Management Platform that transforms how organizations identify, assess, mitigate, and monitor risks

DEPUTY

Deputy aims to enable dependency management at scale by providing core dependency management primitives along with a unified toolchain

RISKY BULLETIN: SLOVAKIA FINDS RUSSIAN BACKDOOR IN TRAFFIC SPEED CAMERAS

Slovakia's national security service (NBU) discovered that recently installed traffic cameras contain a backdoor granting shell and network access via SMS commands from hardcoded Russian phone numbers. The compromised NERO R-ONE cameras, allegedly purchased through a Cyprus shell company, were identified as rebadged units manufactured by a St. Petersburg-based firm. In addition to the SMS backdoor, the NBU technical report revealed that the devices shipped with SecureBoot disabled and exposed live video streams without authentication.

OWASP FLAGS TOP AI SKILL RISKS IN NEW SECURITY BLUEPRINT

OWASP released its Agentic Skills Top 10 and Universal Agentic Skill Format v1.0. Malicious skills and supply-chain compromise rank first and second. A Paperclip impersonation campaign used Trojanized packages and skills. The skills exceeded 300,000 installs, and it shows that the skill format should record provenance, permissions, dependencies, hashes, and changes. Security teams should inventory agent skills and quickly disable flagged ones.

WHY AI LEARNED TO ATTACK BEFORE IT LEARNED TO DEFEND

Offensive AI is outpacing defensive AI due to a structural asymmetry: offensive exploits provide a clear verification "oracle" (the exploit either lands or fails), allowing reinforcement learning loops to train attackers much faster than defenders. The industry is actively experiencing this imbalance: Anthropic's Project Glasswing recently surfaced over 10,000 high- or critical-severity flaws, far outpacing the two-week average patch time, while OpenAI's Daybreak Red achieved a roughly 95% success rate on advanced offensive security tasks. This rapid offensive acceleration, illustrated by the Hugging Face breach in July and the rise of highly capable open-weight models, highlights a growing threat landscape where AI substitutes human effort on offense but only assists on defense.

PRIVATE EQUITY FIRM APOLLO CONFIRMS DATA BREACH AMID HACKING WAVE TARGETING FINANCIAL GIANTS

Apollo disclosed that attackers accessed its cloud environment from July 6 to 10 through social engineering.

TATA'S B2B PLATFORM RETURNED OTPS IN API RESPONSES

Tata nexarc's login API returned the OTP directly in its response body, letting researcher Eaton take over any account, including Tata Steel's own, just by knowing the target's phone number, until CERT-IN confirmed a fix on July 31.

HACKERS INFECT ANDROID CAR HEAD UNITS WITH PROXY BOTNET MALWARE

The MoYu threat group has compromised DoFun-branded Android automotive head units by utilizing a rogue APK to deploy the "JarService" botnet malware. Delivered through the legitimate TWCore system app, the malware pulls instructions from an MQTT broker to convert infected vehicles into remote SOCKS5 proxy nodes and click-fraud clients. While researchers found no evidence of interference with physical vehicle controls, affected owners should actively monitor their network traffic for unauthorized communication with the cardoor[.]cn command domain.

SICKKIDS DATA BREACH EXPOSES EMPLOYEE AND JOB APPLICANT INFO

The Hospital for Sick Children (SickKids) disclosed that it suffered a data breach that impacted employees and job applicants. The hospital stated that the breach was caused by a vulnerability in a third-party software that SickKids and other organizations use.

NEW SYNKLOADER MALWARE PUSHED IN MICROSOFT TEAMS PHISHING CAMPAIGNS

Security researchers from Expel have discovered a previously unknown malware family which it dubbed SynkLoader and is being distributed via Microsoft Teams phishing campaigns. The attack directs victims to install a fake PowerShell Cleaner executable that is hosted in Azure to provide authenticity. The malware allows the attackers to select between modules to deploy: system profiler, persistence module, PhishLocker, which displays a fake Windows login screen to capture Windows account passwords, TrafficRedirector, which allows attackers to reach internal services, a RAT, a VNC, and a module status script.

YOUR OPEN SOURCE MODEL COULD HAVE A HIDDEN TIME-RELEASE BACKDOOR

Researchers have trained LoRA to embed a dormant backdoor into Qwen 3.5 2B that will activate on a later date, executing a shell command instead of responding. This exploits OpenCode's system prompt, which automatically inserts the current date into the context at every turn. The approach builds on Anthropic's 2024 sleeper agent research and successfully triggered on 7 of 8 in-distribution and 9 of 10 held-out prompts on the target date, with no failures elsewhere. Notably, OpenAI's Codex also employs a similar date-leaking mechanism by default. Since OpenCode runs commands via --auto without confirmation, any system that auto-injects timestamps into context should restrict shell command execution to human approval, especially for open-weight models that are unverified.